Privacy Policy

Who we are#

Lockpick is operated by datascience2go Inc., based in Ontario, Canada. We are responsible for the personal data this policy describes. Where data protection law uses the term, we are the controller.

This policy covers the Lockpick website, the web app and any API, agent or command-line access we offer. It does not cover the websites you ask us to assess, which have their own policies.

Our Privacy Officer is accountable for how we handle personal data. You can write to the Privacy Officer at privacy@lockpick.app.

What we collect#

We collect the following, mostly from you and from the sign-in provider you choose.

• Account data. Your name, email address and password, or the basic profile that Google or GitHub shares when you sign in with them.
• Workspace and team data. Workspace names, members, roles and invitations.
• Sites and ownership proofs. The sites you add, and the DNS records or files you publish to prove you control them.
• Reports and submitted material. Assessment results, redacted evidence and the files you choose to upload. Uploaded archives are stored temporarily for processing as described below.
• Onboarding answers and consent records. What you tell us when you set up Lockpick, and when you accepted our terms or chose to receive product email.
• Usage and billing records. The features you use, the scans you start, the waiting lists you join, the Early AI-dopters membership you link to your account (its account id, email and plan), and your plan and purchases. Card details go to Polar, our merchant of record, not to us.
• Security and audit logs. Sign-in events, IP addresses, browser details and records of important actions, which we use to keep accounts and Lockpick secure.
• Support email. Messages you send us and our replies.
• Ask Lockpick questions. Your question and the last few messages of the conversation go to Google (Gemini), which answers from our help pages. When answer matching is on, they also go to TypeSafe (Jev), which looks for a reviewed answer, and if you are signed in and ask about your own account, TypeSafe may also see your sites' names and addresses so it can tell which one you mean. While answer matching is on, we keep a record of each answer, such as how it was answered and your thumbs up or down, for 30 days, without the question text. Do not put passwords, keys or personal details in a question.

We do not ask for sensitive personal data, such as health, biometric, government identity or financial account information. Please do not put it in a site, upload, question or support message you send us.

What each assessment collects#

Website scans read public information about the site you ask us to check: pages, response headers, scripts, DNS records, certificate transparency logs and domain registration data. Public information may contain personal details. Reports keep evidence in redacted form. Deep can also keep up to three pictures of open admin pages it finds, with the page's text, form fields and images covered before each picture is taken. Only workspace members who can read evidence see them, never through a share link, and they are deleted after 30 days.

Pulse and hosted Deep website scans do not sign in or submit forms, and do not collect visitor analytics. These website scans do not require access to your private source repository.

To check a domain, we query public data sources such as crt.sh, public DNS resolvers such as Google Public DNS, and RDAP registration services. They receive only the domain being checked, never your account details.

A Quick check without an account works the same way. We keep the site address and the result so we can show them to you.

Your archive reaches Lockpick. Configured AI review sends selected, redacted file text and paths to Anthropic. Raw chunks are deleted after completion, failure or removal, and become eligible for cleanup after one hour even if a Full review is paused. Continuing an expired review requires a new upload. Stored ZIP reports omit source quotations and expire after 30 days when complete or failed. Provider and backup copies have separate retention.

Deep Local runs on your machine. The authorization request sends Lockpick the project identifier, requested checks and scanner versions; we record the authorization. It does not upload source files, local paths or the report. If you pass the results to an AI assistant, that assistant and its provider receive what you share.

Public repository and skill checks fetch the public code you select and may send redacted excerpts to Anthropic for AI review. Monitor stores submitted package names and versions. A connected repository supplies repository metadata, the chosen commit and selected manifest and lockfile for dependency analysis; it does not grant arbitrary access to your other repositories.

Connected apps and agents#

If you connect an app or agent to Lockpick, such as Claude or the Lockpick command line, we also collect the following.

• Connection records. The account and workspace a connection belongs to, the app's identity and return address, the permissions you allowed, and when the connection was created, used and revoked. We keep access credentials only in hashed form.
• Requests and results. What each request sends us, such as site addresses, site IDs and scan IDs, and what we return. We store them like any other use of Lockpick, with the usage, security and audit records described above.
• Actions. Sites added, scans started and approvals given through a connection are recorded with your account, the same as actions in the web app.

We do not request your conversation history through a connection. The app sends us only what a request needs, so do not put passwords, keys or unrelated personal information into it.

We return findings, redacted evidence, coverage, status and repair guidance to the app. Its maker, such as Anthropic for Claude, handles what passes through the app under its own terms and privacy policy.

Revoking a connection stops it at once. It does not delete past assessments or the records above, which we keep as the retention section describes.

How we use personal data#

• To provide Lockpick, including running the assessments you ask for, showing reports and managing workspaces.
• To confirm that you may test a site, to enforce limits and to prevent misuse, including looking into reports of assessments a site owner did not authorize.
• To keep accounts and Lockpick secure.
• To send service email, such as sign-in, verification, invitation and report email, and product email if you chose to receive it.
• To answer support requests.
• To understand how Lockpick is used and to improve it.
• To handle plans and billing.
• To meet our legal obligations and protect our rights.

We train Lockpick’s defensive security model on anonymized vulnerability findings. We do not use your source code, product ideas, account details or identifying information for training. Anonymized training records contain only a supported weakness category, severity and evidence classification; they contain no code, paths, domains, customer identifiers or free-text reasons. Earlier reports collected under our no-training promise are excluded.

Automated decisions#

We use automated checks to admit, limit or refuse assessments, to confirm control of a site and to detect misuse. We do not make decisions that have legal or similarly significant effects on you based only on automated processing. If an automated check blocks something you need, write to us at support@lockpick.app and a person will review it.

Legal bases for users in the EU and UK#

If the GDPR or the UK GDPR applies to you, we rely on these legal bases.

• Contract, to provide Lockpick under our Terms of Service.
• Legitimate interests, to secure Lockpick, prevent misuse, confirm permission to test and improve the product. We weigh these interests against your rights.
• Consent, for product email and for optional analytics where consent is required. You can withdraw consent at any time.
• Legal obligation, where the law requires us to keep or disclose data.

Cookies and analytics#

We use a cookie to keep you signed in, and Lockpick cannot work without it. If you choose a setting such as a language, we may remember it in a cookie too. We also remember your cookie choice. If you accept optional cookies and follow an invite link, we remember that invite for 30 days so the person who invited you is credited. We do not use advertising cookies.

Product analytics are optional and off unless we configure them. We use PostHog to count how pages and features are used and, when enabled, replay page interactions such as clicks and scrolling. Replay uses anonymous in-memory session identifiers, masks page text, inputs and customer attributes, and excludes images, console logs and network payloads. Page addresses are reduced to route patterns. We may review masked session replays and error reports with AI models from Google (Gemini) and Anthropic (Claude) to find usability problems. Replays reach them masked as described above. Error reports use fixed diagnostic messages, code locations and technical request details, which can include internal account and workspace IDs. Raw exception messages, passwords, keys and tokens are removed. Analytics and replay run only after you accept them in our cookie banner, and stop as soon as you change your choice under Cookie settings. We do not write analytics cookies or persistent browser storage, and we treat Do Not Track and Global Privacy Control as a refusal. Honeycomb records performance and technical diagnostics only after the same consent.

Who we share data with#

We share personal data only as this policy describes.

• Service providers that run parts of Lockpick for us, under contracts that limit how they use the data. These include hosting (Railway and Amazon Web Services), email delivery (Resend), sign-in (Google and GitHub, when you use them), product analytics (PostHog, if enabled) and payments (Polar, our merchant of record, when you buy a paid plan). They also include AI providers, Google (Gemini) and Anthropic (Claude), whose models review masked session replays and error reports to help us find and fix problems in Lockpick. Ask Lockpick questions go to Google (Gemini) and, when answer matching is on, to TypeSafe (Jev), as described above. Anthropic also processes selected redacted code excerpts for configured ZIP, repository and skill AI reviews. OSV receives package names and versions for dependency checks. Honeycomb records performance and technical diagnostics only after the same consent.
• Public data sources, which receive only the domain being checked, as described above.
• People in your workspace, who can see its sites and reports according to their role.
• Anyone you share a report link with.
• Site owners, authorities or others, when we believe it is needed to prevent misuse or harm, for example when a site owner reports an assessment they did not authorize.
• Authorities or other parties, when the law requires it.
• A buyer or successor, if we are part of a merger, acquisition or sale of assets, subject to this policy.

We do not sell personal data or share it for targeted advertising.

Where data is stored#

Our servers are in the United States. If you live elsewhere, your data is transferred to the United States, and our service providers may process it in other countries. Where the law requires it, we use appropriate safeguards for these transfers, such as standard contractual clauses.

How long we keep data#

• Account data, for as long as your account is active and for a reasonable period after it closes, to handle questions, disputes and legal obligations.
• Pulse and hosted Deep read public pages, scripts and domain records. We keep results and redacted evidence to show findings and track repairs. Quick checks expire after 7 days by default. Deep can also keep up to three pictures of open admin pages it finds, with the page's text, form fields and images covered before each picture is taken. Only workspace members who can read evidence see them, never through a share link, and they are deleted after 30 days. Your archive reaches Lockpick. Configured AI review sends selected, redacted file text and paths to Anthropic. Raw chunks are deleted after completion, failure or removal, and become eligible for cleanup after one hour even if a Full review is paused. Continuing an expired review requires a new upload. Stored ZIP reports omit source quotations and expire after 30 days when complete or failed. Provider and backup copies have separate retention.
• Security and audit logs, for a limited period.
• Billing records, for as long as tax and accounting law requires.
• Connection records, while the connection is live and afterwards as part of security and audit logs.

Deleted data can stay in backups for a short time until those backups are replaced.

Security#

We use reasonable technical and organizational measures to protect personal data, such as encrypted connections, access controls and limits on who can see customer data. No system is perfectly secure. If a breach affects your personal data, we will tell you and the authorities where the law requires it.

Your choices and rights#

You can ask us to access, correct, delete or export your personal data, and you can withdraw any consent you have given. Write to us at support@lockpick.app. We may need to confirm your identity first, and we will answer within the time the law requires.

• Canada. Under PIPEDA and provincial privacy laws, you can access and correct your personal data, and you can complain to the Office of the Privacy Commissioner of Canada.
• EU and UK. Under the GDPR and the UK GDPR, you can also object to or restrict some processing, and you can complain to your local data protection authority or, in the UK, to the Information Commissioner's Office.
• United States. Depending on your state, you may have the right to know what personal data we hold about you, to correct or delete it, to get a copy, and to opt out of its sale or its use for targeted advertising. We do not sell personal data or use it for targeted advertising. You can use an authorized agent, and we will not treat you differently for using your rights.
• Everywhere else. Wherever you live, you can make the requests above, and we will handle them under the law that applies to you. If you are not satisfied with our answer, you can complain to the data protection authority where you live.

Children#

Lockpick is for businesses and professionals. It is not meant for anyone under 18, and we do not knowingly collect personal data from children. If you believe a child has given us personal data, contact us and we will delete it.

Changes to this policy#

We may update this policy. The effective date and version at the top of this page show which version applies. If a change materially affects you, we will tell you before it takes effect, by email or in Lockpick.

Contact#

For privacy questions or requests, write to us at support@lockpick.app.

Lockpick is operated by datascience2go Inc., Ontario, Canada.

You can also write to our Privacy Officer at privacy@lockpick.app.